Distant notifications and user view permissions
The MR in djangoldp-account proposes that the user views including /users/xyz/inbox/
would require authentication (djangoldp-account!94 (closed))
Currently the notifications sent by this package are not authenticated
Solutions could be to authenticate it with the server key or with a user agent. It's a variation of the issue with Activity authentication: